PT-2024-9825 · Google+5 · Google Chrome+5

Harry Chen · Published 2024-10-15 · Updated 2025-03-19 · CVE-2024-9966

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.58 Microsoft Edge (affected versions not specified)

Description: The issue is related to an inappropriate implementation in Navigations, allowing a remote attacker to bypass content security policy via a crafted HTML page. This is due to insufficient access control in the component. The exploitation of this issue can enable a remote attacker to bypass existing security restrictions using a specially crafted HTML page.

Recommendations: For Google Chrome versions prior to 130.0.6723.58, update to version 130.0.6723.58 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

ALT-PU-2024-17740

ALT-PU-2025-4366

BDU:2024-11601

CVE-2024-9966

DSA-5793-1

MGASA-2025-0020

OPENSUSE-SU-2024:0337-1

OPENSUSE-SU-2024:14414-1

Affected Products

Alt Linux

Astra Linux

Debian

Google Chrome

Edge

Red Os

References · 61

• 🔥 https://github.com/ading2210/CVE-2024-6778-POC · Exploit
• 🔥 https://github.com/bi-zone/CVE-2024-7965 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-7965-poc · Exploit
• 🔥 https://github.com/r00tjunip3r1/POC-CVE-2024-6778 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:14414-1 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-9966 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0337-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-9966 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9966 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9966 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5793-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html · Vendor Advisory